Calicata
Menu

Specialist service · Risks and verification

Cybersecurity for software and infrastructure

Knowing what to protect starts with understanding where you are exposed.

We review architecture, code and controls to identify risks and prioritise how they are addressed. Each engagement starts with assets, permissions and criteria agreed with your team.

Request a technical consultationSee what we can work on

Tell us the type of system and your objective. Do not send credentials or sensitive details in the first email.

The Calicata mannequin examines transparent modules connected by a cyan signal through a magnifying glass.
The craft of connecting the pieces.Código Palanca

The starting point

You need to decide what to review and what to fix first.

A product brings together users, data and connections. Each change can introduce new risks. We relate those conditions to the specific system and the impact a failure would have.

Risks in context

We relate findings to assets, access and operations. Priorities are explained through their impact and the conditions needed for them to occur.

Evidence you can act on

We document what was reviewed, the findings and the limits of the work. The team can understand which decisions it needs to make.

Fixes that can be verified

We agree on a remediation plan and the criteria for checking changes. The review can support a new release or an existing system.

From the objective to concrete work

What we can work on with you.

A good fit before a launch, when adding integrations or when an existing system needs its controls assessed. Security enquiries have a dedicated contact channel.

Define my next step

Threat modelling

Identification of assets, trust boundaries and relevant scenarios. Review priorities based on the system's context.

Software and architecture review

Analysis of the code, permissions, authentication and controls included in the scope. Findings linked to evidence and verifiable criteria.

Blockchain and cryptography

Review of contracts, integrations and key management where relevant. A cryptographic inventory to assess post-quantum transition needs.

Remediation and verification

A report with priorities and recommendations. The proposal defines whether support for fixes and follow-up checks are included.

A review covers a specific scope at a particular point in time. It does not itself establish absolute security, certification or regulatory compliance. Criteria and the level of assurance must be agreed for each engagement.

Código Palanca applied to your project

Decide. Build. Check.

The first contact covers the type of system and the review objective. We then agree on the information required, permissions and deliverables before starting the work.

  1. We agree on context and authorisation

    We define assets, owners and boundaries. Any active testing requires permissions, rules of engagement and contacts agreed in writing.

  2. We review and document

    We apply the agreed criteria to the system. We record evidence and review findings with the responsible team.

  3. We prioritise remediation

    We order actions and their dependencies. We agree on what must be verified after a fix and what falls outside the review.

View the full process

Technical expertise

Tools to understand and reduce risk.

We choose tools according to the assets, scope and agreed conditions.

Penetration testing and offensive analysis are always carried out with the client's written authorisation.

Network architecture

Segmentation, traffic and access to understand and control the network.

Design and segmentation

  • VLAN
  • pfSense
  • OPNsense
  • VyOS

Firewalls and filtering

  • iptables
  • nftables
  • firewalld

Tunnels and VPNs

  • WireGuard
  • OpenVPN
  • IPsec

Proxy and zero-trust access

  • Cloudflare Tunnel
  • Nginx
  • HAProxy
  • Zero Trust

Traffic analysis

  • Wireshark
  • tcpdump
  • tshark
  • Zeek

Network detection: IDS and IPS

  • Suricata
  • Snort

Discovery and mapping

  • Nmap
  • masscan
  • Netdiscover

Ethical hacking and penetration testing

Tests within an agreed scope to identify and prioritise vulnerabilities.

Base distribution

  • Kali Linux
  • Parrot OS

Reconnaissance

  • Nmap
  • Amass
  • theHarvester
  • Shodan
  • recon-ng
  • Maltego

Web applications

  • Burp Suite
  • OWASP ZAP
  • sqlmap
  • Nikto
  • ffuf
  • Nuclei

Exploitation

  • Metasploit Framework
  • searchsploit
  • Exploit-DB

Credentials and passwords

  • Hydra
  • John the Ripper
  • Hashcat

Wireless networks

  • Aircrack-ng
  • Kismet

Active Directory and Windows

  • BloodHound
  • Impacket
  • CrackMapExec
  • Responder

Post-exploitation and C2

  • Sliver
  • Covenant

Smart contracts and Web3

  • Slither
  • Mythril
  • Echidna
  • Foundry fuzzing

Malware analysis

An isolated lab to study behaviour, binaries and memory.

Laboratory

  • Isolated virtual machines
  • REMnux
  • FlareVM
  • Cuckoo Sandbox

Static analysis

  • Ghidra
  • radare2
  • Rizin
  • IDA
  • YARA

Debugging and dynamic analysis

  • x64dbg
  • GDB
  • Frida

Binary inspection

  • pestudio
  • Detect It Easy
  • capa

Memory and forensics

  • Volatility
  • Autopsy
  • Sleuth Kit

Languages

  • C
  • C++
  • Python 3
  • Rust

AI for security

Signals and models to support analysis, with human review.

Traffic and log anomalies

  • scikit-learn
  • PyTorch

Malware classification

  • Models with YARA rules

LLM-assisted triage with human review

  • Claude
  • Ollama

SIEM and correlation

  • Wazuh
  • Elastic
  • Grafana
  • Loki

Threat intelligence

  • MISP
  • OpenCTI

Server hardening

Configuration and monitoring to reduce server exposure.

Tools

  • Lynis
  • fail2ban
  • CrowdSec
  • WireGuard

The choice depends on the project scope.

Before you start

Questions about Cybersecurity.

Decisions worth clarifying before building.

What do you need to assess a security review?

A description of the system, the objective and the assets involved. The first email should not include credentials or sensitive details. Technical information exchange and access are agreed later.

Can you review a product before launch?

Yes. We define the workflows and controls to review, the environment conditions and the expected evidence. The scope is adapted to the risk and the product's current state.

What does post-quantum readiness mean?

It starts with identifying where cryptography is used, what data it protects and which providers it depends on. That inventory informs the assessment of risks and possible transition steps for the system.

Does the review include fixing the issues found?

The proposal distinguishes review, remediation and follow-up verification. We can assess supporting your team or taking on development work with clearly defined responsibilities.

All services

Rust engineering and advanced systems

For technical work on the reviewed system.

Crypto and Web3

To develop or improve blockchain integrations.

Let’s discuss your next step

Let's define what needs reviewing in your system.

Tell us about the product and the objective. We will agree on assets, permissions and scope before any work begins.

Request a technical consultationMeet the team